How to Avoid a Corporate Account Takeover

Identity theft doesn’t just affect individuals. Businesses large and small are often victims of “corporate account takeover,” a form of business identity theft in which cybercriminals take control of a business’s bank account by stealing employee passwords and other credentials. With that confidential information, criminals can initiate fraudulent wire and ACH transactions from those accounts.

Without the right safeguards and processes in place, all businesses are vulnerable to these kinds of attacks. Gaining access to company computers is relatively easy through “malicious software,” commonly referred to as malware. Malware is typically implemented into a company’s systems when an unsuspecting employee clicks on a seemingly innocent link in an email that downloads software onto the computer and its system, where it finds passwords and other confidential information.

Electronic thefts through financial institutions have ranged from a few thousand to several million dollars. According to Microsoft, cybercrime costs the global community up to $500 billion every year, and one in five small and medium-sized businesses have been targeted. A 2017 survey of small-business owners by Nationwide Insurance found only 13% of respondents believed they had experienced a cyber attack. However, when owners were shown a list of specific examples of attacks, including phishing, viruses and ransomware, the figure of those reporting attacks increased to 58%.

Protect

Maintain security software. You can help protect your system and data by regularly running the latest version of antivirus software; it’s equally important that you deploy a patch software that will update critical operating systems and third-party apps to minimize security issues. These programs will also fix bugs and improve performance of the operating system and apps, and with the rising number of third-party apps being utilized by businesses, this step becomes more critical every day.

Manage access to sensitive data. Only grant access to confidential information (like accounts and passwords) to those in the company who absolutely require it. This minimizes the likelihood of intentional or unintentional misuse. For example, if a specific user only requires “read-only” access to certain files, give him or her only those privileges – not “read-write” access – to minimize vulnerabilities.

Implement software restriction policies or other controls to prevent malware programs from executing from locations they commonly access, like temporary folders that support your internet browsers, and compression/decompression programs.

Back up your system and files regularly! This is critical in the event you become a victim of a cyberattack. Having duplicate data can save your company significant time and money.

Detect

Educate employees. Employees can be your first line of defense when it comes to preventing attacks, but you must first help them understand the threats and how to react to them. Business email accounts are often targeted through social engineering or hacking in which the criminal impersonates an executive and conducts an unauthorized transfer of funds. Employees should be looking for unexplained account or network activity, pop ups, and suspicious emails.

Respond

Nationwide’s survey also revealed that most small businesses were unprepared for cyber criminals. Almost eight in 10 small business (79%) did not have an incident response plan outlining how employees should respond to a data security event in order to help limit its effects. Businesses can mitigate damage and loss that results from cybercrime by responding according to a formal Incident Response Plan. This document should include 1) how to verify suspicious activity, 2) the process for alerting others, 3) how and when to notify the proper authorities, and 4) plans for recovery efforts if needed. Additional guidance on developing an incident response plan for your business can be found in Forbes’ article, “Five Steps for Building an SMB Cyberattack Response Plan.”

Talk to your banker about programs designed to safeguard you from unauthorized transactions. A number of tools are available, such as Positive Pay and other services that offer call backs, device authentication, multi-person approval processes and batch limits, all of which act as barriers to cyber criminals.

Michael Hostak serves as Vice President – Information Technology for Investors Community Bank. He brings a strategic approach to technology and provides valuable insights into both internal and customer needs and goals.

Views provided in this blog are general in nature for your consideration and are not legal, tax, or investment advice. Investors Community Bank (ICB) makes no warranties as to accuracy or completeness of information, including but not limited to information provided by third parties, does not endorse any non-ICB companies, products, or services described here, and takes no liability for your use of this information. Information and suggestions regarding business risk management and safeguards do not necessarily represent ICB’s business practices or experience. Please contact your own legal, tax, or financial advisors regarding your specific business needs before taking any action based upon this information.